Analysis
- max time kernel
149s - max time network
148s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
22/10/2021, 16:17
General
- Target [email protected],pdf.exe
- Size 64KB
- Sample211022-trclhsbgh8
- SHA256 dd4af1effdd1081fccbd05d035c4dfac3b992a358e2a6a6140095d0385ca7f5e
Malware Config
Extracted
-
xloader
-
2.5
-
g8ne
-
http://www.melindair.xyz/g8ne/
-
freesiacreations.com
-
ecopolymer.group
-
ahb9.com
-
ramapuramholdings.com
-
urban-gourmets.com
-
8xaocu.xyz
-
lancasteremerald.com
-
aktau.group
-
thebeachseekers.com
-
ki5rod.com
-
nmsships.com
-
dppu56.com
-
hairwegoca.net
-
aratakablogz.com
-
staunchgomkdt.xyz
-
leslaw.us
-
restaurantperladelmare.com
-
martensakcio.com
-
motherssecret.store
-
deersolutionsfranchising.com
Signatures
- Xloader
Xloader is a rebranded version of Formbook malware.
- Xloader Payload 3 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates system info in registry 2 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 18 IoCs
- Suspicious behavior: MapViewOfSection 5 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[email protected],pdf.exe"C:\Users\Admin\AppData\Local\Temp\[email protected],pdf.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\[email protected],pdf.exeC:\Users\Admin\AppData\Local\Temp\[email protected],pdf.exe3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\chkdsk.exe"C:\Windows\SysWOW64\chkdsk.exe"2⤵
- Suspicious use of SetThreadContext
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/964-55-0x0000000000CC0000-0x0000000000CC1000-memory.dmp
memory/964-57-0x0000000075D31000-0x0000000075D33000-memory.dmp
memory/964-58-0x0000000000C30000-0x0000000000C31000-memory.dmp
memory/964-59-0x0000000004EB0000-0x0000000004F06000-memory.dmp
memory/964-60-0x0000000004660000-0x000000000468A000-memory.dmp
memory/1264-71-0x00000000001E0000-0x00000000001E7000-memory.dmp
memory/1264-74-0x0000000001E70000-0x0000000001F00000-memory.dmp
memory/1264-73-0x0000000001FE0000-0x00000000022E3000-memory.dmp
memory/1264-72-0x0000000000080000-0x00000000000A9000-memory.dmp
memory/1352-75-0x0000000006DD0000-0x0000000006EF5000-memory.dmp
memory/1352-68-0x0000000006CC0000-0x0000000006DCA000-memory.dmp
memory/1752-66-0x0000000000CE0000-0x0000000000FE3000-memory.dmp
memory/1752-61-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1752-67-0x0000000000190000-0x00000000001A1000-memory.dmp
memory/1752-62-0x0000000000400000-0x0000000000429000-memory.dmp
memory/1752-63-0x0000000000400000-0x0000000000429000-memory.dmp